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A fundamental problem in intrusion detection is what metric(s) can be used to objectively 
evaluate an Intrusion detection system (IDS) in terms of its ability to correctly classify 
events as normal or intrusive. Traditional metrics (e.g., true positive ... 
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In Intrusion Detection Systems (IDSs) for Mobile Ad hoc NETworks (MANETs), IDS agents 
using local detection engines alone may lead to undesirable performance due to the 
dynamic feature of MANETs. In this paper, we present a nonoverlapping Zone-based ... 
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Intrusion detection is a critical connponent of secure infornnation systenns. Network 
anonnaly detection has been an active and difficult research topic in the field of Intrusion 
Detection for nnany years. However, it still has some problems unresolved. They ... 
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In order to improve the intrusion detection rates and reduce false positives, a hybrid 
BP/CNN neural network is constructed, which has both the capability of real-time 
classification which BP has and the functionality of time-delay, collection and judgment ... 
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Current IEEE 802.11 wireless networks are vulnerable to session hijacking attacks as the 
existing standards fail to address the lack of authentication of management frames and 
network card addresses, and rely on loosely coupled state machines. Even the ... 
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In 1987, Dorothy Denning published the seminal paper on anomaly detection as applied 
to intrusion detection on a single system. Her paper sparked a new paradigm in intrusion 
detection research with the notion that malicious behavior could be distinguished ... 
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A service-oriented approach to dynannic refinennent of security enforcement is described 
in this paper. This is based on a closed loop feedback system where live distributed trust 
measures are used to adapt access control settings in a changing threat ... 
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In this paper, we present insights generated by modeling the emergence of insider threat 
vulnerabilities in organizations. In our model, we integrate concepts from social judgment 
theory, signal detection theory, and the cognitive psychology of memory ... 
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This paper proposes a statistical mechanism to analyze the detector coverage in a 
negative selection algorithm, namely a quantitative measurement of a detector set's 
capability to detect nonself data. This novel method has the advantage of statistical ... 
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The paper presents an approach based on principles of Immune systems to the anomaly 
detection problem. Flexibility and efficiency of the anomaly detection system are achieved 
by building a model of network behavior based on the self-nonself space paradigm. ... 

Keywords: artificial immune systems, coevolution, network anomaly detection 



l.acm.org/results.cfm?coll=ACM&dl=ACM&CFID=66315543&CFTOKEN=52.. 



5/2/2008 



Results (page 1): intrusion alarms false positive 



Page 4 of 7 




Keywords: Intrusion detection, cluster analysis, data mining, false positives, root cause 

analysis 



12 TesLing inuusion detection systems: a critique of Lhe 1998 and 1999 DAF<PA inuusion 

^ detection system evaluations as performed by Lincoin Laboratory 

^ November 2000 ACM Transactions on I nformation and System Security (Tl SSEC), 

Volume 3 Issue 4 

Publisher: ACM 

Full text available: -Qpdff 155 KB) Additional Information: full citalion, ^bsiract, r5>f5>rsnc.?i:, clt-?d by, ir,d4:> 

Bibliometrics: Downloads (6 Weeks): 40, Downloads (12 Months): 394, Citation Count: 23 
In 1998 and again in 1999, the Lincoln Laboratory of MIT conducted a comparative 
evaluation of intrusion detection systems (IDSs) developed under DARPA funding. While 
this evaluation represents a significant and monumental undertaking, there are a 
number ... 
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Many different demands can be made of intrusion detection systems. An important 
requirement is that an intrusion detection system be effective; that is, it should detect a 
substantial percentage of intrusions into the supervised system, ... 
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The rapid proliferation of wireless networks and nnobile connputing applications has 
changed the landscape of network security. The traditional way of protecting networks 
with firewalls and encryption software is no longer sufficient and effective. We ... 
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We present and empirically analyze a nnachine-learning approach for detecting intrusions 
on individual computers. Our Winnow-based algorithm continually monitors user and 
system behavior, recording such properties as the number of bytes transferred over ... 
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This article describes variants of two state-based intrusion detection algorithms from 
Michael and Ghosh [2000] and Ghosh et al. [2000], and gives experimental results on 
their performance. The algorithms detect anomalies in execution audit data. One ... 
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Intrusion detection systems (IDSs) are used to detect traces of malicious activities 
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The massive volume of Intrusion detection system (IDS) alarms generated on large 
networks, and the resulting need for labor-intensive security analysis of the text-based 
IDS alarm logs, has recently brought Into question the cost-effectiveness of IDSs. ... 
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Ad hoc wireless networks are more vulnerable to malicious attacks than traditional wired 
networks due to the silent nature of these attacks and the Inability of the conventional 
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Despite several years of Intensive study. Intrusion detection systems still suffer from two 
key deficiencies: Low detection rates and a high rate of false alarms. To counteract these 
drawbacks an Interactive detection system based on simple Bayesian ... 
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